Google Security Operations

Hi all, I wanted to understand how the the winder SecOps community has managed ticket management in a MSSP context. As an example, as a MSSP, and if there is a need to escalate a ticket to a customer, what method have you found worked the best?My initial thoughts would be the have a manually initiated playbook by the analyst summarise and escalate the alert as a servicenow ticket to the client, as well as sending a teams notification. A flow might look something like this:Triage & Investigation → Escalation Required (Additional client information needed/approval for action) →  Playbook to mark case as paused and a notification is sent to client which creates a SNOW/Cherwell ticket → Client updates ticket → case SLA resets and internal analyst is notified via assignment of internal SNOW ticket. Obviously the above would have several integration points, but that is my high level thinking. What has worked for others would be greatly appreciated. 

I am attaching a rule below. I need to have an alert when e1 is true or e2 is true but I don't want and alert when we have a combination of e2 and e3 is true. How can i mention then in the rule. rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS { meta:author = "abcd"description = "Detect access to registry keys containing user/system information while suppressing expected Dell activity"severity = "LOW"priority = "LOW"mitre_tactic = "TA0005"mitre_technique = "T1112"case_type = "Anomaly detection" events:// Original detection event$e1.principal.hostname = $host($e1.target.registry.registry_key = /Control Panel\\International\\Geo/ or$e1.principal.process.command_line = /Control Panel\\International\\Geo/ or$e1.target.registry.registry_key = /SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum/)not ($e1.principal.process.parent_process.file.names = "Dell.TechHub.Diagnostics.SubAgent.exe" nocase or$e1.principal.process.parent_process.file.names = "Dell.TechHub.Instrumentation.SubAgent.exe" nocas

The SecOps platform has had a lot more mathematical analytics capabilities built into it but working with it has its own learning curve, I’ve found.  To help with that, I created a new “Stats Hunter” skill:https://github.com/GooGKush/secops-statistical-hunter I’ve tried to make the skill work with someone to find the right kind of search, guiding the users to methodologies and choices before generating a multi-stage YARA-L stats search.  It also tried to give you guidance on noise thresholds.   For example: > Using the stats hunter skill, can you help me identify low prevalence domains over the last month?▸ Thought for 3s, 906 tokens Analyzing Query Approaches To identify low prevalence domains over the last month using the SecOps Statistical Hunter (secops-statistical-hunter) methodology, we model this threat hunting workflow around Fleet-Wide Entity Prevalence (P ≤ 2 internal endpoints) and Query Volume Dispersion over raw telemetry (UDM_EVENTS).

Can this be updated https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-365-defender#sync-alertsThis job is failing as it is not taking into account alerts from insider risk policies for example or dlpThey are prefixed ir or dlp etcadditional.fields["provider_alert_id"]:"86954c42-15b0-4976-8fbf-9fcc9f52bec8" is actually ir86954c42-15b0-4976-8fbf-9fcc9f52bec8[2026-08-18,14:36:50,000 INFO] Found 0 case ids to sync: []Or am I  missing something?Thanks in advance

 As more organizations modernize their workloads, Kubernetes has become the de facto standard for deploying applications. However, this architectural shift introduces a unique challenge for Security Operations: log wrapping. When application logs—such as those from Jenkins—are ingested directly from a container's stdout, they are natively assigned to the KUBERNETES_NODE parser in Google SecOps. Because the actual application data is wrapped inside Kubernetes metadata, out-of-the-box application parsers can't process the payload, leaving security teams with a parsing roadblock. Recently, a customer reached out looking for a way to dynamically route these nested logs to the correct application parsers. In this post, I'll walk you through a complete, hands-on solution to this exact problem. We will build a tailored ingestion pipeline by setting up a Jenkins container lab on GCP, utilizing Pub/Sub and Cloud Functions to intelligently unwrap the data (and writing a custom parser if your JEN

Hello! I’ve found a behavior that tripped me up for a while, so I thought I’d share it here to see if it’s normal and expected, or if other people have found the same behavior and have workarounds for it, or at least can keep it in mind if doing similar things.So, it appears that when using SOAR placeholders to insert an alert variable that contains a ISO-8601 formatted string, the mere act of inserting the [Event.detection_outcomes_timestampField] placeholder reformats it into YYYY-MM-DDThh:mm:ss+00:00 (it drops any fractional seconds, and forces the timezone to UTC expressed as +00:00). This surprised us, because we were explicitly formatting those timestamps in the YARA-L search (in the outcome block, using the timestamp.get_timestamp function https://docs.cloud.google.com/chronicle/docs/detection/yara-l-2-0-functions/timestamp-get_timestamp) so they’d contain millis and be in our local timezone. Besides, timestamp.get_timestamp states that its output is a string, not some special D

Hello Experts,We are attempting to send styled Microsoft Adaptive Cards to Teamschats directly through Google SecOps SOAR playbooks. We designed the card JSON using the official Microsoft Adaptive Cards Designer.However, when passing the JSON payload into the Text parameter of the MicrosoftTeams - Send Chat Message action, the message renders strictly as unformatted raw JSON text in Microsoft Teams rather than as a visual Adaptive Card.Is there an existing parameter, syntax wrapper, or integration configuration in the Microsoft Teams integration that allows Send Chat Message to accept native Adaptive Card JSON payloads?If not, could you provide a supported Python snippet or guide on how to extend MicrosoftTeamsManager so it can properly post application/vnd.microsoft.card.adaptive attachments to Microsoft Graph API?

Hi team, I am wanting to configure the following SLAs in SecOps to do the following:A separate SLA for a case being unassigned A new SLA countdown once the case has been assigned depending on severity A third for when either an action is awaiting approval from second line support e.g the case in an escalation state (between first and second line)Also, has anyone had success in integrating SecOps SLA notifications into 3rd party tools (Slack, ServiceNow, Jira,etc)?  Thanks

 An architecture walkthrough of a purple-team agent that turns detection logic into synthetic telemetry, validates it locally, sends it An architecture walkthrough of a purple-team agent that turns detection logic into synthetic telemetry, validates it locally, sends it to Google SecOps, and reports how far that evidence travelled.to Google SecOps, and reports how far that evidence travelled.  Purple-team validation works, but repeating it is expensive.Testing a detection can mean preparing a host, deploying attack tooling, arranging an EDR exclusion, scheduling a window, running the technique, waiting for telemetry, and cleaning everything up afterwards.We wanted to use agentic AI to make that process easier to repeat, while keeping telemetry structure, verification, platform access, and evidence in deterministic code.The system starts from the detection logic instead of executing the attack:plain-language request → retrieve Sigma rules → generate telemetry → verify locally → mark syn

Given the coming EoL for Python 3.11 in Oct 2027, is planning currently underway at all to start preparing the migration in Google SecOps SOAR to a later version than 3.11 (similarly to what was done for 3.7)?

I have a playbook that needs to generate an alert in a specific environment if certain criteria are met after an investigation has been performed. It seems this may be possible in two ways:Create a UDM event in SecOps and have a detection trigger on it. Create an alert using the SOAR API.It seems both would require a custom integration as these actions/endpoints are not available in the  default integrations available.Which would be preferable? I feel as though going via a detection would be proper, as it would leave a full trail from event to alert. Using the SOAR API would probably be faster and easier however. I’ve been unable to find strong documentation on how to do either, hence the post, thanks!

Hello community, as we know Bindplane now handles NetFlow data thankfully, I am reviewing the SecOps documentation and attempting to create a dashboard to help better visualize this data and while I am building out something I wanted to check in here to see if anyone else has faced similar and how they might have tackled the question..

Azure logs can be exported to Azure Blob Storage and then copied into AWS S3 using an AWS Lambda function. From S3, the logs can be ingested into the SecOps platform.This provides a central AWS-based location for log retention and security monitoring, but it may increase storage, data transfer, and operational costs. The design should include secure authentication, encryption, duplicate handling, monitoring, and lifecycle management.

Hello! This is, I guess, aimed more at Google people (especially ​@dnehoda as the original writer, and I’m really sorry if directly mentioning users is rude) since it’s a question on a Google post, but please feel free to answer if you have relevant information.On the most recent Tip of the Week (on which I can’t reply, hence why I’m creating this new topic) I read that, apparently, “Data tables use $table_name[column_name] syntax”Is that a new thing? From what I’ve read and used, it’s always been %a.b rather than $a[b]. If that’s a new thing, is it different in any way from the old %a.b syntax? I’ve attempted to test the syntax used in the post, and it throws syntax errors---Also, in the same post, there’s an example rule for unauthorized secret access, which has the following in the events block:$secret.principal.user.email_addresses = $sa_email$secret.target.resource.name = $resourcenot $sa_email in $approved_service_accounts[email]not $resource in $approved_secrets[secret_name]That

Hello everyone, I can currently use the SOAR API endpoint /api/external/v1/store/TestIntegration/{integrationInstanceId} as part of a custom script that lists all installed integration instances and then runs the “Ping” action via that endpoint (the equivalent of hitting the “Test” button in the portal when viewing an integration instance) to run the equivalent of a health check (e.g. confirm connectivity and check that auth still works/no secrets have expired). Looking at the SOAR API mapping table (SOAR API mapping table  |  Google Security Operations  |  Google Cloud Documentation), there is no Chronicle API equivalent. Anyone find a solution on how to run the integration ping action via a Chronicle API?

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

Hi everyone,When creating a search filter in Native Dashboard I’ve noticed that the filter seems to be case-sensitive.For example: Searching for johndoe will miss results containing JOHNDOE or JohnDoe Is there a way to make the filter case-insensitive so that user input matches regardless of letter case?

In today's rapidly evolving threat landscape, security teams are challenged by a persistent talent shortage and an overwhelming volume of alerts. Every investigation involves the same repetitive steps: pull evidence from multiple tools, read through it, form a hypothesis, write up recommendations, and update the ticket. None of that work is hard, but it is slow, and it pulls analysts away from the alerts that need human judgment. Google SecOps already brings native AI assistance to investigation, including case summarization and Gemini-backed support inside the platform itself. That covers a lot of ground, but it is scoped to SecOps and to Google's model. Many SOC teams run a heterogeneous stack (multiple SIEMs, EDR, ticketing system, and a mix of AI vendor agreements depending on the business unit) and need their AI-enabled playbooks to reach across all of it. We’ve built the custom integration AIModelQuery for Google SecOps SOAR to close that gap. It lets any playbook call out to any

Hi all,The Alert Overview widget is blank in all views.The case wall is showing output from the Alert Overview block.Anything I am missing to get this working?

Is there a documented procedure for ingesting enrichment data (Assets, Identities) in the SIEM when the source is not listed in Supported log types and default parsers?  Let’s say I have sources such as a CMDB, a less common identity provider, or even an EDR with context data.   Is the answer to construct my own process via this?https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods#importentities 

Hello Google Security team,  I am having questions about Cloud. Is that possible to buy licences for a certain amount of peuple only or do I have to buy a pack? Thanks. Ethan

We have an MS form that posts to GenerateCollaboratorRequest for Travel. In the legacy case view, this data is visible in the Event data:-Can see the custom fields from the form as event data here:-But in the new Cases 2.0 experience, the Event data doesn’t show any of the fields I need:-Am I looking in the wrong place or do I need to perform a different set of steps to pull this into cases 2.0 as I cannot locate this data. Playbook still operates normally and I can reference the Event data in the normal way, it’s just not visually available for analysts to reference.

Hi everyone,Is there a better or recommended way to test integration updates in Google SecOps / Chronicle SOAR, especially for integrations used under Response?

Hi everyone, I have some issues, since 17th July the connector of Ingest Office 365 Security and Compliance alerts using Graph API The alert that is not ingesting is this one:  I didnt touch anything from the config, this is the config that I didnt touch U guys know if something change? Thanks!